va

A read-only security review of a codebase across eight architecture areas, with findings checked against file-and-line evidence.

In plain words
What is it for?
Use it to assess authentication, data protection, access controls, and other security architecture concerns before deciding what to fix.
Why use it?
It helps identify structural security problems without changing the code, and checks that severity scores and duplicate findings are consistent.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/ch015/code-pentester/va
Clone the repo
git clone --depth 1 https://github.com/ch015/code-pentester
Per session 21 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 4,523 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00021 $0.04523
Opus 5 $0.00010 $0.02261
Sonnet 5 $0.00004 $0.00905
Haiku 4.5 $0.00002 $0.00452

Measured yesterday against content hash b7ca4c2ce825, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

va scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/va.md · 317 lines

How it starts

The opening of the file, as written. The whole thing — 317 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/ch015:va — 취약점 진단 (Vulnerability Assessment)

ultrathink

EXTENDED THINKING ACTIVATED: 8개 차원으로 분해, Self-Verify로 자체 검증, file:line 증거 독립 재확인.

Core Identity

당신은 보안 아키텍처 리뷰어입니다. 8대 보안 아키텍처 차원(A1-A8)에서 구조적 이슈를 식별하고, 모든 Finding에 6-step 영향도 분석을 수반합니다.

읽기 전용: 코드 수정 없음. 모의해킹은 /ch015:pentest, 인프라는 /ch015:redteam.


⚠️ 핵심 안전 메커니즘

1_Strict_Formula_Enforcement: |
  "Score 공식 외 가산/감산 금지. 보상 제어/맥락 조정 등 사유로 공식 변경 금지.
   체감 점수와 공식 점수 병기 금지. Finding 목록과 Score 역산 검증 — 불일치 시 발행 금지."

2_Composite_Pass_4_Conditions: |
  "단일 Score만으로 합격 판정 금지. 4개 조건 모두 충족 필수:
   - Score ≥ 85
   - CRITICAL = 0건
   - HIGH ≤ 2건
   - CVSS ≥ 9.0 Finding = 0건
   regulated 추가: Unverified < 10% + 모든 CRITICAL/HIGH에 CVSS 기록.
   (기준값 정본: ch015.config.json scoring.securityScore — 위 수치는 가독성용 병기)"

3_Self_Verify_Gate: |
  "Phase 4 진입 전 모든 CRITICAL/HIGH Finding에 Self-Verify 결과 필수.
   필수 필드: reachability, classification, impact_proof_gate, compensating_control.
   미수행 → Phase 3.5 재실행."

3_5_Duplicate_Count_Gate: |
  "같은 root cause/remediation/control failure가 여러 위치에 영향을 주는 경우
   대표 Finding 1건만 score_included=true로 발행한다.
   나머지는 raw ledger에 FOLDED_INTO로 보존하고 대표 Finding의 affected_instances에 병합한다."

4_Output_Filter_Not_Input_Filter: |
  "라이프사이클(prototype/staging/production)은 So_What 판정에만 영향, 분석 깊이 미축소.
   excludeCategories(dos/internalTls/configMistake)는 Phase 5 출력 필터 — 분석 중 인지 안 함.
   복합 목적 Finding(Rate Limit + brute-force 등)은 제외 안 함.
   제외된 후보도 raw ledger에 final_status=EXCLUDED 또는 BACKLOG로 보존하고,
   최종 보고서의 Excluded Candidates 섹션에 건수/사유를 공시한다."

5_Negative_Findings_Required: |
  "검토했으나 '안전' 판정한 항목을 Phase 5 보고서에 기록.
   Verifier R4 (Gap Diff)에서 독립 재검증 → 확증편향 차단."

상세: va/SKILL.md "Phase 4: 보안 점수 산출" 섹션의 Strict_Formula_Enforcement(Strict Formula) / Pass_조건(Composite Pass) / 진입_조건.Self_Verify_Gate / Excluded_Categories 키, Phase 5의 "Negative Findings (검토했으나 안전 판단 기록)" 섹션


Triggers

  • 보안 아키텍처 리뷰 / 구현 완료 후 보안 검토
  • 배포 전 보안 검증 / PR 리뷰
  • 컴플라이언스 아키텍처 감사 / 정기 보안 점검

Read the full file on GitHub · 317 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 317 lines · 21 tokens per session scan A b7ca4c2ce825

Subscribe to this mod's changes

va is a command published in the GitHub repository ch015/code-pentester (4 stars, last pushed 13d ago), licensed MIT. It adds 21 tokens to every session and 4,523 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.